PT-2010-4294 · Apache+1 · Apache Http Server+1

Published 2010-07-23 · Updated 2023-02-13 · CVE-2010-2791

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache HTTP Server version 2.2.9

Description The issue is related to an information disclosure flaw in the mod proxy component of the Apache HTTP Server. When running on Unix platforms, if a timeout occurs while reading a response from a persistent connection, the backend connection is not closed. This allows remote attackers to potentially obtain sensitive responses intended for other clients under certain circumstances. The flaw is triggered by specific timeout conditions and affects configurations that use proxy worker pools.

Recommendations For Apache HTTP Server version 2.2.9, as a temporary workaround, consider globally configuring the server with the setting: SetEnv proxy-nokeepalive 1. This configuration change can help mitigate the risk of information disclosure until a more permanent fix is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2010-2791

RHSA-2010:0659

RHSA-2010_0659

Affected Products

Apache Http Server

Red Hat

References · 30

• http://redhat.com/support/errata/RHSA-2010-0659.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-2791 · Security Note
• https://osv.dev/vulnerability/CVE-2010-2791 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2010-2791 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2010-2791 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2013:150 · Vendor Advisory
• https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E · Note
• https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E · Note
• https://lists.apache.org/thread.html/r1d201e3da31a2c8aa870c8314623caef7debd74a13d0f25205e26f15%40%3Ccvs.httpd.apache.org%3E · Note
• https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E · Note
• https://httpd.apache.org/security/vulnerabilities_22.html#CVE-2010-2791 · Note
• https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E · Note
• https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E · Note
• https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E · Note
• http://securityfocus.com/bid/42102 · Note